It attempted to perform a Smurf attack on the SSH server.

It attempted to perform Heap Overflow attacks on the Apache server.

Multiple requests with the same Max-Forwards header.

The IP attempted to perform Directory Traversal attacks on the Apache server.

POST //user/register?element_parents=timezone/timezone/%23value&ajax_form=1&_wrapper_format=drupal_ajax: Drupalgeddon3 exploit, another Drupal remote execution vulnerability.

It made multiple requests with the same Referer header.

This IP belongs to Tumblr.

The IP attempted to use the FTP server as a proxy for other malicious activities.

Multiple requests with the same X-Wap-Profile header.

The IP attempted to use the Mail server to relay phishing emails to other servers.

Our data revealed this IP distributing malicious powershell scripts.

The IP attempted to send emails from the Postfix server pretending to be from a different sender.

This IP has been detected spreading notorious credit card skimmers.

Made various attempts at a forged return-path attack, attempting to spoof their source email address.

Because of numerous attacks using malicious mobile code, this IP has been blacklisted.

The IP attempted to perform DNS Spoofing attacks on the Apache server.

The IP address attempted to login to the SSH server with an invalid username.

HTTP Header Overflow: Logs showing HTTP headers with overly large amounts of data can indicate attempts at header overflow attacks.

Reverse Tabnabbing Attempts: Logs illustrating target="_blank" in URL, which is a sign of reverse tabnabbing attempt.

The IP attempted to use the FTP server to distribute hacking tutorials.

It exploited insecure server configurations and attempted to establish reverse SSH tunneling.

This IP belongs to British Telecommunications.

This IP belongs to Cardinal Health.

Login attempts at unusual times (e.g., in the middle of the night).

The IP attempted to perform a Multicast DNS amplification attack on the SSH server.